6a3e1833f43f867e153935467c1a7c1f7f9c2c4b7b4c716a54f959989f091bf2

Resubmissions

16/03/2024, 15:20

16/03/2024, 15:16

max time kernel
149s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
16/03/2024, 15:16

Target
Trojan/3PC.exe
Size 229KB
Sample240316-sns9esdf21
SHA256 cb3dd0893f9feda97ab93fff5d607f508c5fbae775b2280a8534c07c0ca4a336
MD5 a5fa59d5da5b595056892a2653e94243
SHA1 f307ae227a656333f8deb99b8e20e2e6dd966b0e
SHA512 a7fd5f28f7ea176333b3144b05306a2d2729e59088bb8ea3e24ba20b5b414a112522fb539b0f6a00a13e3a87874fc4f4968822a718eb3c77b4d53088dd4aea1d
SSDEEP 6144:lBlkZvaF4NTB88S1hJp7OdUoIeYZeOzv4npK:loSWNTW8S5YdUPeVOzQpK
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4860 wrote to memory of 4876	4860	3PC.exe	91
PID 4860 wrote to memory of 4876	4860	3PC.exe	91

C:\Users\Admin\AppData\Local\Temp\Trojan\3PC.exe
"C:\Users\Admin\AppData\Local\Temp\Trojan\3PC.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4860
- C:\Windows\system32\cmd.exe
  "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\42C6.tmp\42D6.tmp\42D7.bat C:\Users\Admin\AppData\Local\Temp\Trojan\3PC.exe"
  2⤵
  PID:4876

42D7.bat

Path C:\Users\Admin\AppData\Local\Temp\42C6.tmp\42D6.tmp\42D7.bat
Size 597B
SHA256 c0f46b9a7fc82f7007adc96523159ae10571a099eeb0cc00eb930e91424a24a1
MD5 ffa0ad441b308bc1da589f8a734e806f
SHA1 704fc5c8773489b91d2f1ef221ab60ecd3257e3e
SHA512 bfeec821a3b26270e52990799d1c525845203ece47989c161cfa9ecf02675122d8bf1ef8dc3f3db199825d50fd6f4ee54312d8bf4ed827681284e715a6fac55b
MD5 SHA1 SHA512

Submit Download